WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-20 21:52:21 +02:00
Code Issues Packages Projects Releases Wiki Activity
2,094 Commits 80 Branches 17 Tags
docker
Commit Graph
246 Commits
Author SHA1 Message Date
cometandikelos beed68b8bf update 2020-01-27 23:31:05 +00:00
Mike Auty f00453e366 Procdump: Remove redundant line as caught by @iMHLv2 2020-01-22 19:49:11 +00:00
Michael Lighandikelos 1d7da6402b svcscan cleanup: win10 before 15063 uses win8 types 2020-01-22 19:23:30 +00:00
Mike Auty 9fe6e6ba37 registry: Add the hivedump plugin 2020-01-17 17:22:04 +00:00
Mike Auty 8f71c61440 layerwriter: Fix mistaken hardcoded layer name. 2020-01-16 23:07:27 +00:00
Mike Auty 99af98f639 layerwiter: Refactor to classmethod. 2020-01-16 22:57:47 +00:00
Mike Auty 2d408491bd Printkey: Slightly improve subkey name determination. 2020-01-15 02:19:12 +00:00
Mike Auty 3f5b96f3c7 Yapf: Clean-up the whole codebase. 2020-01-14 15:44:07 +00:00
Mike Auty b7ba877727 procdump: Enure proc_id is defined. 2020-01-14 15:36:54 +00:00
doomedravenandikelos 07b94abc1e Update procdump.py 2020-01-14 10:52:05 +00:00
doomedravenandikelos cdc0835863 Update procdump.py 2020-01-14 10:52:05 +00:00
doomedravenandikelos e4d7b7975f expose process_dump to other plugins 2020-01-14 10:52:05 +00:00
Mike Auty fda64dde95 Mac tasks: Swap the shortcircuiting order 2020-01-13 14:13:37 +00:00
iMHLv2andGitHub f7cc94a244 Merge pull request #168 from volatilityfoundation/issue-10-vad-protection-layer 
Use a kernel layer to read vad protection constants
 2020-01-04 10:02:59 -06:00
Michael Ligh b7b6c44eab remove unused variable in vaddump.py 2020-01-04 09:35:51 -06:00
iMHLv2andGitHub af468e7657 Merge pull request #162 from Lyx09/fix_vad_dump_var 
VadDump: Fix incorrect variable out_of_range in vad_dump
 2020-01-04 09:34:25 -06:00
Mike Auty d2daa12564 Malfind: Rename the layer_name parameter to be more descripttive 2020-01-03 22:12:04 +00:00
Andrew Caseandikelos d7f5a13c46 Mac - properly check for broken proc pointers 2020-01-03 19:42:18 +00:00
Andrew Caseandikelos 3bf3e0601a Remove earliler trigger of SymbolError 2020-01-03 17:50:06 +00:00
Andrew Caseandikelos a66e1bb6c2 Move symbol catching to generator 2020-01-03 17:50:06 +00:00
Andrew Caseandikelos 65556a2c92 Linux - update handling of kernels that do not have loadable module support 2020-01-03 17:50:06 +00:00
William LIN e6656c96af VadDump: Fix incorrect variable out_of_range in vad_dump 2019-12-26 19:51:13 +01:00
Michael Ligh cd841616af refs #144 use a kernel layer to read vad protection constants 2019-12-08 07:46:02 -06:00
Mike Auty fa26dbf659 Yarascan: Make generic yarascan just scan kernel memory. 2019-12-04 23:17:10 +00:00
Mike Auty f34958a16d Poolscanner: Add necessary exception handling. 2019-12-04 22:11:42 +00:00
Mike Auty 386f94d9ee Pool: Make object_header type checking the plugin's responsibility. 2019-12-04 22:11:42 +00:00
Mike Auty 8691c68604 Pool: Refactor pool extension to its own file. 2019-12-04 22:11:42 +00:00
Michael Lighandikelos d0f9cf9a2f refs #139 use _EPROCESS.ControlFlowGuardEnabled to distinguish between windows 10 <= 15063 versus >= 16299 2019-12-04 21:19:19 +00:00
Mike Auty af3b3e305f Timeliner: Report progress on which plugin is being run. 2019-12-04 17:25:33 +00:00
Mike Auty b6d807ff51 Poolscanner: Document the typing issue of python3.5's IntEnum over IntFlag 2019-11-27 11:30:14 +00:00
Mike Auty b0b868d79c Typing: General typing fixes across the tree 2019-11-27 11:30:14 +00:00
Mike Auty 31ddbaaa2e Typing: Fix python3 format string/byte output issues 2019-11-27 11:30:14 +00:00
Mike Auty 249c3ec223 Svcscan: Ensure or later checks are done in order. 
Relates to issue 139.
 2019-11-18 20:57:34 +00:00
Mike Auty b99ace86fb Tidy up exceptions to be more accurate. 2019-11-13 19:58:14 +00:00
Mike Auty 40fcdf9469 exceptions: SymbolErrors now contain specific information 2019-11-13 19:27:00 +00:00
doomedravenandikelos 4543b0af33 Update vaddump.py 2019-11-13 18:54:19 +00:00
doomedravenandikelos 97f670ec79 simplify vad dump to be used by other plugins 2019-11-13 18:54:19 +00:00
Mike Auty face38436e layers: Fix up uses of is_valid. 2019-11-12 09:09:51 +00:00
Mike Auty 23b14b772a Poolscanner: Fix error in index checking. 2019-11-09 00:17:07 +00:00
Mike Auty ee31ece006 Fix a logging on add_process_layer exceptions. 
There were a number of issues with commit 3df5e995 that was applied in
haste (notably, that exceptions wasn't imported in several cases, which
would break the code if it were ever run).

We now give debugging output when a process can't be constructed and
provide as much available information as possible.

Two unused lines were also removed from verinfo.
 2019-11-03 23:15:38 +00:00
Mike Auty 73aa73f30e Ensure we test None using is rather than ==. 2019-11-03 22:46:20 +00:00
Mike Auty dd3e09f1e2 frameworkinfo: Make this a core plugin, not an optional extra. 2019-10-31 22:14:43 +00:00
Mike Auty 4457bcaee0 vadyarascan: Ensure we scan the right layer 
This patch ensures we scan the vad segments within the correct layer
(the process layer, not the kernel layer) and lists the pid in the
output.
 2019-10-31 19:15:02 +00:00
Mike Auty 27a291cf61 Remove the erronious print statement, which should be a vollog message if needed. 2019-10-18 08:39:56 -04:00
Mike Auty 0be9061989 Tidy up commit e0097ac. 2019-10-18 08:38:17 -04:00
atcuno 545376d725 Mac - update trustedbsd 2019-10-17 15:30:13 -04:00
atcuno 3df5e9957e Windows - add missing add_process_layer exception handling in a few plugins 2019-10-17 11:47:19 -04:00
atcuno e0097ac9c1 Windows - protect handles from smear 2019-10-17 11:03:48 -04:00
atcuno 2e329d1106 Windows - add exception handling around is_valid in callbacks 2019-10-17 10:22:06 -04:00
Mike Auty 3784c9aff6 Fix up missing/inaccurate plugin description strings. 2019-10-03 01:05:57 +01:00